Niklas Schnelle 324c31b0e0 s390/pci: fix iommu bitmap allocation ... commit c1ae1c59c8 upstream. Since the fixed commits both zdev->iommu_bitmap and zdev->lazy_bitmap are allocated as vzalloc(zdev->iommu_pages / 8). The problem is that zdev->iommu_bitmap is a pointer to unsigned long but the above only yields an allocation that is a multiple of sizeof(unsigned long) which is 8 on s390x if the number of IOMMU pages is a multiple of 64. This in turn is the case only if the effective IOMMU aperture is a multiple of 64 * 4K = 256K. This is usually the case and so didn't cause visible issues since both the virt_to_phys(high_memory) reduced limit and hardware limits use nice numbers. Under KVM, and in particular with QEMU limiting the IOMMU aperture to the vfio DMA limit (default 65535), it is possible for the reported aperture not to be a multiple of 256K however. In this case we end up with an iommu_bitmap whose allocation is not a multiple of 8 causing bitmap operations to access it out of bounds. Sadly we can't just fix this in the obvious way and use bitmap_zalloc() because for large RAM systems (tested on 8 TiB) the zdev->iommu_bitmap grows too large for kmalloc(). So add our own bitmap_vzalloc() wrapper. This might be a candidate for common code, but this area of code will be replaced by the upcoming conversion to use the common code DMA API on s390 so just add a local routine. Fixes: 2245932155 ("s390/pci: use virtual memory for iommu bitmap") Fixes: 13954fd691 ("s390/pci_dma: improve lazy flush for unmap") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-10-25 12:03:15 +02:00
..
alpha	alpha: remove __init annotation from exported page_is_ram()	2023-08-16 18:27:31 +02:00
arc	ARC: atomics: Add compiler barrier to atomic operations...	2023-09-19 12:28:04 +02:00
arm	ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone	2023-10-25 12:03:09 +02:00
arm64	arm64: dts: mediatek: mt8195-demo: update and reorder reserved memory regions	2023-10-19 23:08:55 +02:00
csky	…
hexagon	…
ia64	…
loongarch	LoongArch: numa: Fix high_memory calculation	2023-10-06 14:57:01 +02:00
m68k	m68k: Fix invalid .section syntax	2023-09-13 09:42:21 +02:00
microblaze	…
mips	MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled	2023-10-06 14:56:45 +02:00
nios2	…
openrisc	…
parisc	parisc: Restore __ldcw_align for PA-RISC 2.0 processors	2023-10-10 22:00:45 +02:00
powerpc	powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()	2023-10-19 23:08:58 +02:00
riscv	riscv, bpf: Sign-extend return values	2023-10-19 23:08:53 +02:00
s390	s390/pci: fix iommu bitmap allocation	2023-10-25 12:03:15 +02:00
sh	sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()	2023-09-19 12:28:04 +02:00
sparc	…
um	um: Fix hostaudio build errors	2023-09-13 09:42:58 +02:00
x86	KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously	2023-10-25 12:03:14 +02:00
xtensa	xtensa: boot/lib: fix function prototypes	2023-10-06 14:56:49 +02:00
.gitignore	…
Kconfig	…